New answers tagged

0 votes

Security Headers: Access-Control-Allow-Origin vs. Cross-Origin-Resource-Policy (CORP)

When a website requests resources from a different origin, it is considered a cross-origin request. Browsers implement a same-origin policy to restrict such requests. The same-origin policy allows a ...
Marcin Wanago's user avatar
1 vote

CRLF in HTTP/2 header value

RFC 9113 HTTP/2 says that headers are a type of field: HTTP fields (Section 5 of [HTTP]) are conveyed by HTTP/2 in the HEADERS ... And that newlines can be dangerous: Failure to validate fields can ...
Sjoerd's user avatar
  • 30.4k

Top 50 recent answers are included